15 ms·
Firms That Promised Ransomware Decryption Almost Always Just Pay the Hackers
- jkao-propublica 7y agoHey HN, I'm a reporter at the non-profit newsroom ProPublica. I used to be a software engineer in the Bay Area, but now I work primarily with data and code for news investigations. We published a story today that found that a lot of the firms touting their ransomware decryption services actually end up paying the hackers (often behind the client's back) and then tacking on a fee. Though you all would find it interesting. A great tidbit that my reporting partner Renee uncovered: a former deputy FBI director was paid to promote MonsterCloud, while knowing that they paid bitcoin to cybercriminals. He's also a former TSA director. So of course, he partnered with their CEO on a side biz to put massage chairs in airports. ¯\_(ツ)_/¯ Anyway, thought this would be a story that HN would enjoy. Would love to hear y'all's thoughts since this is the community with the expertise & experience to comment. If you have things (ransomware or otherwise) you think we should look into, would love to hear as well. :-)
- jpfed 7y ago>a former deputy FBI director >He's also a former TSA director. That narrows it down a bit. With a name like that you'd hope he was more of a straight shooter.
- behringer 7y agoWell we're talking about the TSA here.
- inflatableDodo 7y agoThousands Standing Around, now with added massage chairs.
- acct1771 7y agoI would encourage you to read more political news/geopolitical discussion.
- dboat 7y agoWhat does this comment mean? Like, read more in general, or what?
- acct1771 7y agoYes, and about the topics I mentioned.
- dboat 7y agoThat wasn't helpful. Instead of repeating a vaguely condescending remark, please elaborate on what you think he needs to learn.
- jpfed 7y agoUm, guys, this is a little embarrassing but I was literally just making a lame pun about the dude's name. awkward finger guns
- inflatableDodo 7y agoI liked it. I even curled my upper lip appreciatively after reading and let out a derisive snort. At least I hope that's what it was.
- jmkni 7y agoFrom the article: > former FBI Deputy Director John Pistole
- stOneskull 7y agoI don't think it matters if the people are from Iran. It's still people messing with a hospital and paying them, for now, is the best strategy. Then a system put in to where paying them isn't necessary.
- deleted 7y ago[deleted]
- pbhjpbhj 7y ago>put massage chairs in airports // Do the chairs hack your phone or something, I've never seen anyone pay to use one, only sit on them without paying. They have them in motorway service stations in UK as well as at airports.
- milofeynman 7y agoI love propublica and donate monthly. Good to see it getting some great tech coverage. Thanks for your reporting!
- shearskill 7y agoThanks for the reminder to donate, they really do fine work. AC Thompson is an acquaintance and his coverage of fringe extremists is thorough and anxiety inducing, but his investigations have led to bad guys going to jail many times over.
- devereaux 7y agoWhy am I not surprised? They just provide plausible deniability to clients, who may not be able to pay the ransom for legal reasons.
- olliej 7y agoOr their clients are naive I don’t recognize that they’re being charged more to “decrypt” than the cost of the ransom, or (plausibly) the client is intentionally not paying the ransom because they (incorrectly) believe it means they aren’t giving money to criminals.
- XorNot 7y agoOr they maintain back channels to the groups and negotiate discounted rates on the basis of reliability of pay outs.
- olliej 7y agoI was actually wondering about that - or alternatively ye olde protection racket type thing: they being the original authors of the attack. Of course it’s much more plausible that they’re just scumbags looking to make an “honest” profit of a criminal act.
- Phlarp 7y agoWe aren't being presented any evidence that they are playing both sides of the table that brazenly. However, I can't see a situation where if the firm were in a position to stop the ransomware globally that they would actually do so. Maybe an altruistic individual within the company, but not as a directed managerial effort.
- olliej 7y agoLike I said - probably just general scummy behavior rather than criminal behaviour
- 7y ago
- tcarn 7y agoThere needs to be more accountability for Bitcoin, solve btc and you solve a lot of these hacks...
- olliej 7y agoThe lack of accountability in btc is considered a feature. The fact that funds can be tracked at all is considered a bug, hence monero and zerocoin etc.
- quickthrower2 7y agoNot just a feature, it's the reason for bitcoins existence.
- acct1771 7y agoOne of maaaaany.
- deleted 7y ago[deleted]
- syshum 7y agoumm no... That entire purpose of bitcoin is to remove accountability, to make a digital version of cash that can not be blocked, censored, or regulated by governments or corporations. See Some people like the idea of freedom
- junipertea 7y agoIn this case criminals.
- syshum 7y agoOk, And, criminals use cash as well, would you be infavor of a cashless society? Somehow I bet you would, with understanding the complete ramifications of such a society
- paid-themselves 7y agoSo... How do we know that they (MonsterCloud) weren't also the criminals on the other side of the bitcoin transaction? Is it possible this was all a giant payola/extortion ring? I mean, the criminals were just that reliable, organized and scrupulous about unlocking their victims?
- westpfelia 7y agoThis was my first thought. Why not be on both sides of this. Make double the money
- yoz-y 7y agoIf it became known that ransomware criminals never actually decrypt your data they would lose their "business", so it is in their interest to actually do it. It certainly is not impossible that the decrypting company would be so scummy but it is in the same vein as accusing a home security company financing burglars to go on rampage.
- lftl 7y ago> If it became known that ransomware criminals never actually decrypt your data they would lose their "business", so it is in their interest to actually do it. This opens up one of those weird moral dilemmas akin to asking whether it's moral to hack someone's exposed device to patch a security hole: Would it actually be a net positive to create a ransomware variant that had no decryption key, but acted like it did?
- shittyadmin 7y agoThere've been a few cases where the ransomware was not decryptable - sites like BleepingComputer frequently discuss which ransomware have been cracked by researchers, which are currently actively run and will provide keys and which are undecryptable and you shouldn't pay in any circumstances. Basically it just makes things more complicated, but people are still willing to pay if they can in their specific case and the one they're infected with is reported as regularly providing good keys.
- deleted 7y ago[deleted]
- hackerbabz 7y agoThis must be a result of pure ignorance of the victims. As far as I understand, ransomware simply applies RSA on the victim's data. If the victims understood what that meant, they would understand that it is entirely unrecoverable. The data is simply gone without the private key. If the data were recoverable that would mean RSA had been broken, and the entire world would know about that. Normal people would understand because the global financial system would need to stop entirely while they switched to a new algorithm.
- deleted 7y ago[deleted]
- john_moscow 7y agoThere are implementation details that could make the data recoverable even when RSA is used. The data itself is typically encrypted using a symmetric cipher (e.g. AES) and the key used for it would be encrypted using RSA. However, if the key for the symmetric algorithm was generated in a predictable way (e.g. using a pseudo-RNG initialized from the system time), it could be possible to bruteforce it in reasonable time.
- deleted 7y ago[deleted]
- chillacy 7y agoThat assumes they applied the encryption correctly. There are many ways to mess it up, and there have been anti-ransomware software made for buggy versions of ransomeware in the past.
- davidgerard 7y agoIt's worth checking it's not fake ransomware - that claims to encrypt your files, but ... doesn't actually bother! c.f. https://www.infoworld.com/article/3062552/how-to-tell-if-youve-been-hit-by-fake-ransomware.html https://www.infoworld.com/article/3062552/how-to-tell-if-you...
- SmellyGeekBoy 7y ago
- SlowRobotAhead 7y agoI guess the only surprising part to me was paying behind the clients back and charging a little more. Because on the surface, of course you pay the ransom! I specifically selected insurance that stated up front they would pay a ransom if they had to. I think this has to be fairly common knowledge outside of infosec. Perhaps some CTO/CIO/CFO types would rather the peace of mind or the idea that they aren’t helping these ransom-entrepreneurs out by paying them.
- shittyadmin 7y agoI feel this is actually a decent service for a few reasons: - Many average users don't want to understand cryptocurrencies, how to safely and securely buy and use it is a challenge in and of itself. - They're on the hook and the client pays nothing if the ransomer fails to provide a working key. - They'll also manage the ransom decryption software - if there's problems with it there are 3rd party tools that can often do a better job of decryption than the original decryption tool, again, this is something that's going to be complicated for average users to deal with. - For some ransomware there are decryption processes available without the need to pay the ransom, figuring out which of these applies can be challenging - Certain institutions may be unable or unwilling to work with the attacker directly - introducing a middle man to broker can help solve this. Overall the piece seems somewhat hyperbolic.
- el_benhameen 7y agoAnd all of that would be a fine service if they were honest about it.
- acct1771 7y agoPlausible deniability for a CTO that doesn't want to be known for negotiating with terrorists As A Service?
- infogulch 7y agoTNaaS: Terrorist Negotiation as a Service. It's the biggest new craze since blockchain.
- TeMPOraL 7y agoThere already exists ransom insurance (the real-life kind of ransom), and private ransom negotiators, so TNaaS isn't such a stretch at this point.
- taneq 7y agoProfessional negotiator is a well respected role and they're used all the time by police etc. This seems like a fairly direct analogue, so...? (Full disclosure since someone else was asking for it: I have nothing to do with any of this stuff.)
- hcs 7y agoI'd never heard of this historical precedent: > The father of ransomware was Harvard-educated anthropologist Joseph L. Popp Jr. While researching the theory that AIDS originated in green monkeys in East Africa, Popp in 1989 mailed more than 20,000 floppy disks about AIDS education to people interested in public health. When recipients ran the disk, their computers froze, and a message on the screen instructed them to send up to $378 to a post office box in Panama for a second disk that would restore their access.
- john-radio 7y agoHoly crap, that message: > ATTENTION I have been elected to inform you that throughout your process of collecting and executing files, you have accdientally ¶HÜ¢KΣ► yourself over: again, that's PHUCKED yourself over. No, it cannot be; YES, it CAN be, a √ìτûs has infected your system. Now what do you have to say about that? HAHAHAHAHA. Have ¶HÜÑ with this one and remember, there is NO cure for AIDS.
- ghevshoo 7y agoI found this interesting story with details about how he was caught, set free, and left behind an unusual legacy including founding a eponymous butterfly conservatory. https://medium.com/un-hackable/the-bizarre-pre-internet-history-of-ransomware-bb480a652b4b https://medium.com/un-hackable/the-bizarre-pre-internet-hist...
- hcs 7y agoInteresting, thanks! This reminds me of all the random shareware we'd get on floppies in the early 90s, Apogee and such.
- arosier 7y ago> Although bitcoin transactions are intended to be anonymous and difficult to track, ProPublica was able to trace four of the payments. I didn’t think Bitcoin transactions were intended to be anonymous and difficult to track, why would Bitcoin use a public ledger if that was the intention? I was under the impression other cryptocurrencies are trying to solve for “anonymous and difficult to track.”
- asperous 7y agoWhat other cryptocurrencies are trying to solve is making transactions anonymous and hidden by default. You can hide your identity and tumble your coins to achieve both in bitcoin if you know what you are doing. But there are plenty of stories of people who did not know how to use Bitcoin in an anonymous way and investigators were able to track transactions.
- Shank 7y agoThey are intended to be roughly anonymous, as in not-identifiable, not untraceable. Bitcoin also predates all other cryptocurrencies, and is the most widely used or prolific. Last I checked, there were also several operational mixing services that would gladly launder your funds for you (for a nominal fee). It's more surprising to me that they didn't end up using a system like this before performing the final payment capture. But maybe if they're overseas, they don't care?
- tinus_hn 7y agoThey are anonymous because although you can see the ledger, you don’t know who is the owner. All the ledger says is ‘whoever knows the private key for this public key can spend this money’. You can still catch people once they convert it to normal currencies though.
- anextomp 7y agoThe term is pseudonymous - the list of all transactions is available for anyone to look at but in theory you can't link bitcoin addresses to people. However, in practice, most people buy bitcoins via a method that requires ID, which links their ID to one of their addresses. Multiple addresses can then be linked together by cluster analysis based on usage patterns
- qwerty456127 7y agoDon't the hackers almost always just take you money and demand more without actually decrypting anything?
- deleted 7y ago[deleted]
- SolarNet 7y agoNo, that is counter to their making money. The way to make money through ransoming something on a regular basis is to always ensure you follow through. There are actual cases in history of ransomers attacking fellow ransomers who don't follow through for hurting the shared business model.
- billpg 7y agoI think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up. "True" ransomware requires a key management infrastructure with a capacity for delivering a service. Setting up a bitcoin recipient takes next to no resources. If you were criminally minded, what would you do? It would harm the ransomware-maker's reputation? Just pick a new name every week.
- kkarakk 7y agoyou're assuming the knowledge on how to make a ransomware business is freely disseminated. it's not, there are very particular darknet websites and societies that keep each other updated on the latest techniques and likely targets for attack. It is trivial for them to hear about an attack where the person didn't follow through on the unlock and at that point they just freeze the offender out of their "club". It is that way in the ransomware/game cracking/early piracy(before release) "scene"
- billpg 7y agoI am an ordinary software engineer and I could build "ransomware" that does nothing but wipe the victim's disks and demands money be paid to a hard-coded bitcoin address in a convincing looking way. I don't need criminal contacts to do that.
- scarejunba 7y agoLet's be honest. There's only one way this ends. You have vigilante ransomware dudes who promise to decrypt the ransomed stuff and then abscond with the money. Poison the well and people will just assume they've lost the data.
- swombat 7y agoThat actually would probably work... especially if the vigilantes masqueraded as the “genuine” hackers convincingly. Then you (or the companies covered in TFA) would just have no way of knowing whether there is any chance of recovering the data for real. As the probability of recovery goes down, the likelihood of being willing to pay the ransom also goes down. Though in a way this feels a bit like going around _actually shooting_ people in order to “poison the well” for a group that goes around _threatening to shoot_ people, but not actually shooting them if they pay up.
- jacobush 7y agoYes, and also with the guys not actually shooting if you pay working hard on establishing a brand everyone can "trust". They could for instance sign their releases of malware so it couldn't easily be spoofed by the proposed vigilantes.
- prirun 7y agoAnother option would be to hire a data security firm to do ongoing penetration testing at your business, perhaps even to the point of supplying employee email addresses. Then if the business is penetrated by the security firm, they can give notifications of what needs to change, who needs to be educated about clicking on email links, etc.
- devit 7y agoIs this legal?
- AnIdiotOnTheNet 7y agoK&R insurance is legal, so why not?
- pbhjpbhj 7y agoK&R == kidnap & ransom
- unnouinceput 7y agoquote 1 : “The reason we have such a high recovery rate is that we know who these attackers are and their typical methods of operation,” he said. “Those victims of attacks should never make contact themselves and pay the ransom because they don’t know who they are dealing with.” quote 2: " It stopped dealing with the SamSam hackers after the U.S. government identified them as Iranian and took action against them, he said. Until then, he said, the company did not know they were affiliated with Iran. " There you have it, the way of the managers, lie lie and more lies, as long as $$$ can be made.
- unnouinceput 7y agoAlso this. Quote: "Witherspoon was especially impressed by his primary contact at MonsterCloud, Zack Green. “Zack’s title, dear God, it’s a mile long title. He seems to know a lot.” Green’s titles on his email signature include “Ransomware Recovery Expert,” “Cyber Counterterrorism Expert,” “Cyber Crime Prevention Expert” and “Cyber Intelligence Threat Specialist.” We called MonsterCloud asking for Green but were told he was in a meeting." In my experience on dealing with US managers, the longer the titles they have, the dumber the person is.
- glenneroo 7y agoSounds more like a bullshit artist than an idiot.. otherwise they wouldn't be getting enough jobs to stay a profitable enterprise.
- WrtCdEvrydy 7y ago> the longer the titles they have, the dumber the person is. "I've been here 3 years, I want a promotion...." "Here's a pointless fancier title with no pay bump"
- Havoc 7y agoOutsourcing the "we don't negotiate with terrorists" problem...
- jasonhansel 7y agoI think there's a case to be made for making ransom payments illegal. Allowing such payments only encourages the development of newer, more sophisticated ransomware.
- ianhawes 7y agoAs much as I want to appreciate this story, it's lines like this that reflect poorly on it's authenticity: > In a video posted online touting MonsterCloud’s services, Pinhasi wears a dark suit and tie and rimless glasses. At lunch, the 43-year-old sported a white long-sleeve T-shirt emblazoned with the logo of teen retailer Abercrombie & Fitch.
- fredsted 7y agowhy?
- ianhawes 7y agoIt is a clear ad hominem attack on Pinhasi. It adds nothing to the story, especially without context. This piece masquerades as a serious discussion about the ethics of ransomware services but goes out of it's way to equate their personal habits with that of their business.
- joncrane 7y agoHow does this subtract from authenticity? It's literally facts.
- markbnj 7y agoHow is it an ad hominem attack to describe his attire? You could argue it's irrelevant, but you'd find such descriptions in nearly any piece of this sort.
- motohagiography 7y agoBuying discounted receivables is one of the oldest businesses around. That it happens to be for a criminal ransomware organization is new. The instinct to contact ransomers and say, "hey, I see you have some uncertainty in how much money you are going to collect. Do you want a guaranteed amount now, or a risk adjusted figure later? If now, I can offer you $x for a key I can use on as many customers as I can..." Ethics aside, that's really impressive deal making.
- el_cujo 7y agoUnless you've got tools on the level of what the CIA or NSA has, you're probably not cracking the encryption, but I agree it's bad to mislead your clients (and also creates some conflict of interest concerns). It kind of reminds me of when a family member is having computer problems and asks me to fix things. They think I have some sort of deep knowledge of how the computer works and can pinpoint their exact problem to fix it, when in reality I just back up their files and reinstall windows without really knowing why things were messed up.
- LinuxBender 7y agoSortof Off Topic: If your data is important, back it up to something that automation, daemons and users can't tamper with. i.e. Immutable after ${n} minutes or hours. Replicate that data to multiple places and ensure it is also immutable in that location. I think everyone knows this, but make excuses not to do it. i.e. cost, laziness, indifference, risk takers, etc.
- francisofascii 7y agoMonsterCloud quote: “Our goal is to restore the data and help the customer. If we need to walk to the moon on broken glass, we will. We don’t care how, what, where, whatever. Our goal is to get the data out.” Sounds like if they don't care how, paying the criminals is a viable option for them.
- bitcoinfailure 7y agoOf course they pay them, who actually believes these firms are capable of breaking the encryption? This is digital hostage taking, you pay the hostage takers, you don't try and fight them.